Skip to main content
Org rulesets defined once, in code, instead of click-ops repeated across every repo.
tofu-github puts the dryvist GitHub organization’s rulesets under OpenTofu, applied through the same Terrakube workspace pattern as the rest of the homelab. GitHub doesn’t auto-inherit CI or branch-protection config across repos. The old pattern was a reusable workflow plus a per-repo call copied into every repo, which drifts. Org rulesets (available since dryvist moved to the GitHub Team plan) let dryvist define this once and apply it to every repo automatically.

​
What it manages

  • Push protection. A hard ceiling on file size and a banned-extension list, enforced at the git layer (no workflow run) on every repo and ref.
  • Branch protection. Required commit signatures, a branch-name pattern, a strict Conventional Commits regex, and PR thread resolution on every default branch, with no bypass for anyone, including org admins.
  • Review gate. One approving review plus a CODEOWNER review on every default branch, with an admin-only bypass so admins can merge their own PRs while bots and other contributors still need the review.
  • Markdown lint. Requires the markdownlint workflow (defined once in the org’s .github repo) to pass on every ref of every repo, with new repos exempted until their default branch exists.

​
How it fits

​
Getting started

1

Clone and enter the dev shell

git clone git@github.com:dryvist/tofu-github.git && cd tofu-github && direnv allow
2

Log in to the Terrakube workspace

tofu login "$TF_CLOUD_HOSTNAME" requires membership in the org’s terrakube-admins team. It needs no AWS account and no local GITHUB_TOKEN. Terrakube injects the org-admin GitHub credential at run time.
3

Plan and apply

tofu init && tofu plan && tofu apply runs plan and apply remotely in Terrakube. Output streams back to the local shell.

tofu-proxmox

Same OpenTofu-through-Terrakube pattern, applied to the Proxmox cluster instead of GitHub.

tofu-unifi

Same pattern again, applied to the UniFi controller’s data plane.

CI/CD policy

The per-repo CI/CD conventions these org rulesets enforce the shape of.

Source on GitHub

Ruleset definitions, config thresholds, full README.